"service logstash start" does not work

Elastic Stack Logstash
1

Hi,

I have Ubuntu 16.10 and the latest Logstash installed.
Running Logstash manually with /usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash" works just fine but I'm unable to run it as a service.
Any help would be greatly appreciated.

Thanks,
X

2

What do the logs say?

1 Like
3

check what sudo services logstash status says
It will usually explain why the service didn't start

4

logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset:
Active: active (running) since Thu 2017-04-20 10:49:23 IDT; 1min 24s ago
Main PID: 5036 (java)
Tasks: 17 (limit: 4915)
Memory: 315.5M
CPU: 24.560s
CGroup: /system.slice/logstash.service
└─5036 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMS

Apr 20 10:49:23 PRIL1ELK02 systemd[1]: Started logstash.

5

Even though it shows as being running...well, it just does not.
it does not load my beats config file unless I run it manually.
And the logs are NOT being written to.
Only showing stuff when the manual command is being run.

6

That doesn't look like the LS log, from /var/log/logstash/?

7

/var/log/logstash/
does not show anything when running the "service logstash start" command.

8

Check where your logstash.conf is https://www.elastic.co/guide/en/logstash/current/running-logstash.html
maybe is not picking it up

9

You mean logstash.yml or the beats.conf?

logstash.yml is at
/etc/logstash

beats.conf
/etc/logstash/conf.d

10

I meant logstash.conf
check your systemd config (if you are using systemd) should be in /etc/systemd/system
and will look like this where you will have the location of the logstash.conf

11

I found the following:

root@PRIL1ELK02:/etc/systemd/system# cat logstash.service
[Unit]
Description=logstash

[Service]
Type=simple
User=logstash
Group=logstash

Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.

Prefixing the path with '-' makes it try to load, but if the file doesn't

exist, it continues onward.

EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
EnvironmentFile=-/etc/logstash/startup.options
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384

[Install]
WantedBy=multi-user.target

12

I am not completely sure about this, but the ExecStart should point to your logstash.conf file also, something like:

ExecStart=/usr/share/logstash/bin/logstash "-f /etc/logstash/logstash.conf" "--path.settings" "/etc/logstash"

13

I do not have a "logstash.conf" file anywhere.

14

Oh well, that explains a lot :smile: make sure to have one if you want Logstash to do something.

15

Not really.
I think what you refer to as "logstash.conf" is my "beats.conf".

Anyway just came to say that my problem all long was permissions.
/etc/logstash was taken by root ever since I installed Xpack I believe.

Now the service works as it should.

16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.